Multi-Site Support in Red Hat build of Keycloak - Frequently Asked Questions

The release of Red Hat build of Keycloak version 24.0 added initial support for high availability across multiple sites deployment. This feature has been improved in the following Red Hat build of Keycloak release version 26.0, and now further enhanced in the newer version 26.4.
This article provides a complementary guidance to the latest High Availability Guide to better set the support scope and limitations when using the Red Hat build of Keycloak for Multi-Site High Availability deployments.

Frequently Asked Questions

What is "Multi-Site" in Red Hat build of Keycloak?
Multi-Site is a Keycloak feature to address users' requirements for a highly available and scalable production-grade deployment of Keycloak across multiple "sites" (or data-centers).

What is the scope of "sites" in the Keycloak's Multi-Site feature?
The "sites" are considered to be two data-centers, physically separated from each other. They may be located in the same geographical region (continent), country, or city. The "sites" must not be located in two separated geographic regions (or continents) as that would refer to a Multi-Region deployment, not a Multi-Site one. Multi-Region deployment with Red Hat build of Keycloak is not a supported deployment scenario and is not planned for now.

Are there constraints or limitations on the distance in between the "sites"?
There is no hard limit put on distance. The network latency in between the "sites" matters the most.

Note: The Multi-Site deployment blueprint as documented in the High Availability Guide is officially tested and certified in a single AWS Region with two or three Availability Zones acting as the "sites". AWS Content from docs.aws.amazon.com is not included.states that all Availability Zones (AZs or "sites") in a Region are meaningfully distant from each other, up to 60 miles (~100 km) to prevent correlated failures, but close enough to use synchronous replication with single-digit millisecond latency. This distance provides isolation from the most common disasters that could affect data-centers (i.e. utility power, water disruption, fiber isolation, earthquakes, fires, tornadoes, or floods).

Is there any limitation on the network latency in between the "sites"?
There is no hard limit set for the latency network connection in between the sites.

Note: With the tested blueprint for Multi-Site deployment, all AWS Availability Zones (AZs or "sites") in a Region are interconnected with high-bandwidth, low-latency networking, over fully redundant, dedicated metro fiber. This results in single-digit millisecond latency between resources in different Availability Zones in the same Region. Therefore, Red Hat highly recommends to use Multi-Site for deployment across data-centers with low-latency network connection (i.e <10ms) to minimize the risks of potential performance issues or data loss during sites-failover. Any deployment of Multi-Site needs to be tested for performance and failover prior to running in Production.

What types of HA deployment models are supported for the Multi-Site feature in Red Hat build of Keycloak?
Multi-site feature was initially introduced in version 24.0 and supported for HA active-passive with OpenShift Multi-cluster deployment and a synchronous database replication.
The following version 26.0 introduced significant improvements to the HA Multi-site architecture, enabling each site to handle user requests simultaneously. Therefore active-active deployment setups are supported since version 26.0, while the previous configuration which leveraged active-passive loadbalancer still continue to work.
The newer Red Hat build of Keycloak version 26.4 introduces further enhancements for support of high-availability architectures based on OpenShift Single-cluster deployment spanning multiple availability-zones in any cloud provider (e.g Azure, GCP, AWS, IBM Cloud, etc.) and on-premise private data-centers. Any of the Keycloak's supported databases can also be used, as long as it can tolerate zone/data-center failures and synchronously replicates data between the availability zones or on-premise data centers.

Note: Refer to the Red Hat build of Keycloak High Availability Guide and Supported Configurations KBase article for more information on the requirements for Multi-site supported setup and the behavior to expect, as well the benefits and tradeoffs.

Is HA Multi-Site feature supported for on-premises deployments?
Yes, but only starting with version 26.4. Red Hat build of Keycloak version 26.4 enables extended support for high-availability architectures based on OpenShift Single-cluster deployment spanning multiple availability-zones in any on-premise private data-centers.

Is HA Multi-Site feature supported when deployed on cloud providers such as Microsoft Azure, Google Cloud Platform, IBM Cloud, etc.?
Yes, starting with version 26.4 and for multi-site architectures based on OpenShift Single-cluster deployment spanning multiple availability-zones in any cloud provider (e.g Azure, GCP, AWS, IBM Cloud, etc.).
Note that OpenShift Multi-cluster deployment across multiple sites is still limited to OpenShift deployment in two availability zones on AWS Cloud with ROSA and use of Amazon Aurora PostgreSQL database.

Which High Availability deployment model options are available as recommended alternatives to the HA Multi-Site feature for on-premises and other cloud providers environments (esp. for non-OpenShift users)?
A simpler architecture with a Disaster Recovery plan through Active/Cold-Standby deployment model may work and satisfy some users (including non-OpenShift users).
Typically, this requires having a synchronously/asynchronously replicated database (or perhaps an external shared database) between the 2 sites. Then, only one site is used as the active site at any time for receiving traffic from the load-balancer, while the other site (i.e secondary site) is configured with Red Hat build of Keycloak in a Cold-Standby mode. The secondary site may only be spinned up during outages in the primary site, and it will then handle the traffic.
This setup does not also require the use of Red Hat Data Grid in the mix. Only configuring a clustered Keycloak node-instances in each site should be enough. Refer to Configuring distributed caches documentation for a Red Hat build of Keycloak clustered setup with Keycloak multi-nodes instances running in a single site.
This configuration with a secondary Cold-Standby site is a fully supported architecture and can be used for on-premises and other cloud providers environments, as long as the Red Hat build Keycloak clusters are deployed accordingly to the Supported Configurations (meaning use of RHEL VMs or OpenShift, use of any of the supported JVMs and Databases, etc.).

Which database can I use for Red Hat build of Keycloak HA Multi-Site feature deployment? Is Amazon Aurora PostgreSQL the only supported database?
AWS Aurora PostgreSQL is ONLY required for OpenShift Multi-clusters deployment in two availability zones on AWS Cloud with ROSA.
Starting with version 26.4, any of the Keycloak's supported databases can be used for HA deployment architecture based on OpenShift single-cluster deployment spanning multiple availability-zones on any cloud provider or on-premise data-centers. The used database is still required to tolerate zone/data-center failures and synchronously replicates data between the availability zones or on-premise data centers.

Note: Red Hat cannot test and certify Keycloak with all kind of databases. Support for more databases in Keycloak (and so the HA Multi-Site feature) may be added in the future, but not guaranteed as not planned for now.

Do I need to use Red Hat Data Grid for Red Hat build of Keycloak Multi-Site deployment?
The use of Red Hat Data Grid is ONLY required for OpenShift Multi-clusters deployment in two availability zones on AWS Cloud with ROSA.
It is not required and not needed for OpenShift Single-cluster deployment across cloud providers' multiple availability zones or on-premise data-centers.

Note: Refer to the High Availability Guide for more information about how Data Grid is used with Red Hat build of Keycloak for a Highly Available setup through OpenShift Multi-clusters deployment on AWS and use of Aurora PostgreSQL database for synchronous replication.

Is there a Sizing guide for Red Hat Build of Keycloak Multi-Site deployment?
Yes, the High Availability Guide includes sizing chapters for HA Single-cluster and Multi-Cluster setups.
You may also leverage the Content from www.keycloak.org is not included.Keycloak Benchmark tool and use the Content from www.keycloak.org is not included.Keycloak on ROSA Benchmark Key Results as a starting point for performance load testing and adjust the sizing for your environments as needed. These sizing guidance and tools can be used for deployment of Red Hat Build of Keycloak in any other environments.

Note: Red Hat highly recommends customers to engage with Red Hat Services (Red Hat Consulting) for sizing activities. A lot of factors may come into play for a proper sizing calculation, and depend on the customer specific use-cases and requirements.

Which subscriptions/entitlements are required for Red Hat build of Keycloak Multi-Site deployments?
Entitlements to Red Hat build of Keycloak (and Red Hat Data Grid, for use in OpenShift Multi-clusters setup) are required for a Multi-Site deployment. Refer to the This content is not included.Red Hat Application Services subscription guide for the subscriptions details covering both Red Hat build of Keycloak and Red Hat Data Grid. See also Red Hat build of Keycloak Subscriptions/Entitlements requirements.

Note: Contact your local sales representative or use This content is not included.Contact Red Hat to reach out for a further guidance on your subscriptions usage.